From 5a4010725693e87124cd5a440b5b7921e700c1a5 Mon Sep 17 00:00:00 2001
From: nexxo <nexxo@clupilot.local>
Date: Tue, 28 Jul 2026 13:30:56 +0200
Subject: [PATCH] Return to the console by name after impersonation, not a bare
 path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

redirect()->to(AdminArea::home()) resolved against whatever host the
leave() POST itself arrived on — the portal's, once the console has a
hostname of its own — landing the operator on the portal's dashboard
instead of back at the console. route('admin.overview') is domain-bound
to the console and generates the correct cross-host URL, matching what
this line did before this branch. The test named after this behaviour
now actually asserts it.
---
 app/Http/Controllers/ImpersonationController.php | 11 +++++++++--
 tests/Feature/ImpersonationTest.php              |  7 ++++++-
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/app/Http/Controllers/ImpersonationController.php b/app/Http/Controllers/ImpersonationController.php
index 148e6c2..4bb164d 100644
--- a/app/Http/Controllers/ImpersonationController.php
+++ b/app/Http/Controllers/ImpersonationController.php
@@ -4,7 +4,6 @@ namespace App\Http\Controllers;
 
 use App\Models\Customer;
 use App\Models\Operator;
-use App\Models\User;
 use Illuminate\Http\Request;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Support\Facades\Auth;
@@ -95,6 +94,14 @@ class ImpersonationController extends Controller
         session()->forget('impersonator_id');
         Auth::guard('web')->logout();
 
-        return redirect()->to(\App\Support\AdminArea::home());
+        // By NAME, not AdminArea::home(): this route is reached on the
+        // PORTAL's host, and home() is a bare path ('/' in exclusive mode) —
+        // resolved against whatever host the request is already on, which is
+        // the portal's, not the console's. admin.overview is domain-bound to
+        // the console in exclusive mode, so route() generates the correct
+        // cross-host, absolute URL back to it; in shared mode it resolves
+        // against the current host same as home() would, so nothing changes
+        // there.
+        return redirect()->route('admin.overview');
     }
 }
diff --git a/tests/Feature/ImpersonationTest.php b/tests/Feature/ImpersonationTest.php
index 5c56b08..decc340 100644
--- a/tests/Feature/ImpersonationTest.php
+++ b/tests/Feature/ImpersonationTest.php
@@ -72,7 +72,12 @@ it('leaves the operator session untouched, so leaving returns to the console', f
 
     expect(Auth::guard('operator')->check())->toBeTrue();
 
-    $this->post(route('impersonate.leave'));
+    // "Returns to the console" is the point of this test, not merely
+    // decoration on its name — redirect()->to(AdminArea::home()) used to
+    // resolve that bare path against whatever host the leave() POST itself
+    // arrived on (the portal's), not the console's; see the exclusive-mode
+    // test below for where that actually bites.
+    $this->post(route('impersonate.leave'))->assertRedirect(route('admin.overview'));
 
     expect(Auth::guard('web')->check())->toBeFalse()
         ->and(Auth::guard('operator')->check())->toBeTrue();